80% of companies experience security incidents in the Cloud
Migrating to the Cloud brings many advantages for companies. First of all, they reduce their operating costs by almost 40%. They also increase their agility, reduce the maintenance time of traditional IT infrastructures, and gain flexibility and scalability. However, as the number of workloads deployed in the Cloud grows, more and more organizations are struggling to keep pace with security requirements.
In the last year, more than 80% of organizations have experienced security incidents in the Cloud and 41% of engineers believe that security in this environment will become even more challenging as the next generation of Cloud-native applications are deployed.
What are the main attack vectors in Cloud environments?
-
Compromised accounts: Google Cloud analysis has shown that brute force attacks are the most common entry vector in Cloud environments and were responsible for 51% of cyberattacks in the first quarter of this year. Another widespread form of compromising accounts entails threat actors purchasing credentials on the dark web or exploiting credentials exposed in public repositories. This usually happens because organizations do not implement a multi-factor authentication (MFA) solution to secure their accounts.
-
Exploiting applications in the Cloud: In IaaS environments where Cloud customers manage their own web applications and systems, classic web application vulnerabilities are still common and exploiting them is an effective way to gain access to environments. Exploitation of vulnerable software is the second most frequent threat vector, accounting for 37% of Cloud threat activity.
-
Misconfiguration misuse: misconfiguration within Cloud architectures plays a key part in becoming potential victims. Management consoles without password protection or with default passwords are responsible for 30% of such attacks. Likewise, exposed server workloads account for 27% of threats. This is followed by overly permissive service or user accounts (25%), publicly exposed web servers without WAF (web application firewall) and/or a load balancer (23%), VMs or containers running as root (22%), management interfaces without multi-factor authentication (22%), traffic to unauthorized IPs (22%), disabled logging (19%), and open ports (19%).
-
Phishing: Phishing also presents a threat to Cloud environments. Administrators are often tricked via email into accessing pages that emulate those of Cloud providers, resulting in credential theft when logging into their accounts from the fraudulent portal.
Achieving Cloud security
Adopting cyber hygiene practices such as using multi-factor authentication to protect access to accounts, being aware of potential phishing, updating and patching software, and ensuring the elements that are part of the Cloud architecture are configured properly are essential first steps.
WatchGuard's Cloud firewall is part of these cybersecurity best practices, functioning as a firewall for physical network environments, although it also acts to protect servers in the Cloud. This enables it to detect and prevent advanced attacks such as ransomcloud or zero day threats that attempt to evade network defenses. By incorporating AI, protection becomes predictive, which means it can protect against evolving malware.
One of the biggest challenges for Cloud security professionals is gaining visibility in the environment to ensure stronger data protection. This is why our Firebox Cloud provides full visibility, enabling faster decision-making and easier security management.
